Post-Market Surveillance Reporting and PSUR: 70-Day and 90-Day Rules and the Two-Year Cycle

1. Key takeaways

The UAE Good Pharmacovigilance Practices (GVP) Guidelines fix two numbers for the periodic safety update report (PSUR): where the reporting interval does not exceed 12 months, the report is due within 70 calendar days of the data lock point; where the interval exceeds 12 months, it is 90 calendar days. At the same time, vigilance data and documents must be retained for at least 10 years after the termination of the marketing authorization. Article 23(4) of Federal Decree-Law No. 38/2024 carries the post-market reporting obligation at the level of the law. Our judgment is that the real difficulty of periodic reporting lies not in the act of submission but in the setting of the data lock point (DLP): Chinese manufacturers often set the DLP at the end of the calendar year, which leaves the reporting interval misaligned with the date of registration approval and in turn disturbs the renewal rhythm. We recommend aligning the DLP with the marketing authorization approval date and configuring archiving on the longest basis.

• PSUR within 70 calendar days of the data lock point for intervals of 12 months or less; 90 calendar days for longer intervals.
• Vigilance data and documents are retained for at least 10 years from termination of the marketing authorization.
• Article 23(4) of Federal Decree-Law No. 38/2024 anchors the post-market reporting obligation in the law itself.
• A two-year PSUR frequency for high-risk devices is a practical estimate with no official source; rely on the EDE approval letter or written confirmation.

2. Legal basis

The GVP provisions that fix the PSUR clocks and the retention floor, together with the federal provisions on post-market reporting and authorization validity, are set out below.

3. Expert insights

Insight 1: The 70/90 dividing line is the length of the reporting interval, not the risk class of the product. Our professional judgment is that a company can choose the applicable deadline by controlling the length of the interval; this is a pure calendar rule. The reason is that the GVP Guidelines use 12 months as the sole dividing line and set up no separate tier for high-risk devices. On the trade-off, setting the interval at exactly 12 months still falls on the side of 12 months or less, and the 70 calendar day deadline applies; we do not recommend letting the interval cross beyond 12 months, which would gain 20 extra calendar days of buffer but at the cost of a longer cumulative exposure period.

Insight 2: The 10-year retention runs from termination of the marketing authorization, not from issuance of the certificate. The judgment is that expiry of the registration certificate without renewal, revocation and voluntary cancellation all trigger the 10-year countdown. The reason is that the wording used by the GVP Guidelines is after termination of the marketing authorization. On the trade-off, the archiving system must not purge automatically by the expiry date on the certificate; a separate retention flag should be set for vigilance data, and the retention obligation should be written into the agreement with the responsible entity to prevent records from being scattered after a change of responsible entity.

Insight 3: A two-yearly PSUR for high-risk devices is a practical estimate. The judgment is that the GVP Guidelines prescribe no frequency tiers for device PSURs, and the industry practice of once every two years has no official regulatory source. The reason is that the periodic reporting arrangement for devices has not yet been elaborated by the Executive Regulation. On the trade-off, we recommend fixing the frequency by the requirements stated in the EDE registration approval letter or by product-by-product written confirmation; do not adopt the two-year cycle on your own initiative, and do not write it into commitment documents with counterparties.

4. Practical recommendations

• Align the PSUR data lock point with the marketing authorization approval date, keep the interval within 12 months, and apply the 70 calendar day submission deadline.
• Set DLP calendar reminders, starting data aggregation on day 30 after the data lock point to leave full room for internal review and sign-off within the 70 days.
• Configure the archiving rules for 10-year retention, with the starting point at termination of the marketing authorization, and no automatic purging by the validity date on the certificate.
• Fix the PSUR frequency by the EDE approval letter or written confirmation; the two-year cycle for high-risk devices serves only as a practical estimate reference and is not written into commitment documents.
• Agree with the responsible entity that the in-country portion of PSUR data is provided by it within a deadline after the DLP, the overseas portion is aggregated by the manufacturer, and the interface persons are fixed.
• Schedule the PSUR together with renewal under Article 7 (5 years) so that periodic reports and renewal dossiers do not pile up in the same window.

5. Verification checklist

• □ The PSUR data lock point is aligned with the marketing authorization approval date, with intervals not exceeding 12 months
• □ DLP calendar reminders are in place, with submission deadlines back-planned on 70 calendar days
• □ Archiving rules are set for 10-year retention, starting from termination of the marketing authorization
• □ The PSUR frequency is supported by the requirements in the EDE approval letter or by written confirmation
• □ The division of PSUR data tasks and the deadline for provision are written into the agreement with the responsible entity
• □ The PSUR schedule is managed together with the Article 7 5-year renewal node
• □ The scope of vigilance data archiving covers individual case reports, PSURs and field safety notices

Further reading: Article No. 42, Adverse Event Reporting Timelines: Federal Approach and the Abu Dhabi DOH 5-Day and 15-Day Standards; Article No. 45, Change Management: Notification of Minor Changes and Re-Approval of Major Changes (Article 15); Article No. 8, The Five-Year Validity Period and Renewal: Article 7 and the EDE Official Renewal Service.

Regulatory information verified as of October 29, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the United Arab Emirates. Our team manages adverse event reporting and recall coordination with MOHAP, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com